Feature/cloudsql secret manager (#1273)

* initial commit

* initial commit

* added empty password check in mysql

* changed naming

* added missed files, fixed merge issues

* design changes, added tests

* Added utils

* tests , refactoring

* naming change for password secret id

Author: sm745052

accessors/clients/secretmanager/secret_manager_client.go

@@ -0,0 +1,48 @@
+package secretmanagerclient
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	googleapis "github.com/googleapis/gax-go/v2"
+	"google.golang.org/api/option"
+)
+
+type SecretManagerClient interface {
+    AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...googleapis.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error)
+    Close() error
+}
+
+// ClientCreator is a function type for creating a Secret Manager client.
+type ClientCreator func(ctx context.Context, opts ...option.ClientOption) (*secretmanager.Client, error)
+
+// SecretManagerClientFactory manages the creation of Secret Manager clients.
+type SecretManagerClientFactory struct {
+    client  *secretmanager.Client
+    creator ClientCreator
+    once    sync.Once
+}
+
+var defaultFactory = &SecretManagerClientFactory{
+    creator: secretmanager.NewClient,
+}
+
+
+func (f *SecretManagerClientFactory) GetOrCreateClient(ctx context.Context) (*secretmanager.Client, error) {
+    var err error
+    f.once.Do(func() {
+        f.client, err = f.creator(ctx)
+    })
+    if err != nil {
+        return nil, fmt.Errorf("failed to create secret manager client: %v", err)
+    }
+    return f.client, nil
+}
+
+
+var NewSecretManagerClient = func(ctx context.Context) (SecretManagerClient, error) {
+	return defaultFactory.GetOrCreateClient(ctx)
+}

accessors/clients/secretmanager/secret_manager_client_test.go

@@ -0,0 +1,70 @@
+package secretmanagerclient
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	googleapis "github.com/googleapis/gax-go/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"google.golang.org/api/option"
+)
+
+// MockSecretManagerClient is a mock of SecretManagerClient interface
+type MockSecretManagerClient struct {
+	mock.Mock
+}
+
+func (m *MockSecretManagerClient) AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...googleapis.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error) {
+	args := m.Called(ctx, req, opts)
+	return args.Get(0).(*secretmanagerpb.AccessSecretVersionResponse), args.Error(1)
+}
+
+func (m *MockSecretManagerClient) Close() error {
+	args := m.Called()
+	return args.Error(0)
+}
+
+func TestGetOrCreateClient(t *testing.T) {
+	callCount := 0
+	creator := func(ctx context.Context, opts ...option.ClientOption) (*secretmanager.Client, error) {
+			callCount++
+			return &secretmanager.Client{}, nil
+	}
+
+	factory := &SecretManagerClientFactory{
+			creator: creator,
+	}
+
+	ctx := context.Background()
+	client1, err := factory.GetOrCreateClient(ctx)
+	assert.NoError(t, err)
+	assert.NotNil(t, client1)
+
+	// Call again, should return same instance and not increment callCount
+	client2, err := factory.GetOrCreateClient(ctx)
+	assert.NoError(t, err)
+	assert.Equal(t, client1, client2)
+	assert.Equal(t, 1, callCount)
+}
+
+func TestGetOrCreateClient_Error(t *testing.T) {
+
+	expectedErr := fmt.Errorf("client creation failed")
+	creator := func(ctx context.Context, opts ...option.ClientOption) (*secretmanager.Client, error) {
+		return nil, expectedErr
+	}
+
+	factory := &SecretManagerClientFactory{
+			creator: creator,
+	}
+
+	ctx := context.Background()
+	client, err := factory.GetOrCreateClient(ctx)
+	assert.Error(t, err)
+	assert.Nil(t, client)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+}

accessors/secretmanager/secret_manager_accessor.go

@@ -0,0 +1,43 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package secretmanageraccessor
+
+import (
+	"context"
+	"fmt"
+
+	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	secretmanagerclient "github.com/GoogleCloudPlatform/spanner-migration-tool/accessors/clients/secretmanager"
+)
+
+type SecretManagerAccessor interface {
+	GetSecret(ctx context.Context, secretId string) (string, error)
+}
+
+type SecretManagerAccessorImpl struct {
+	Client secretmanagerclient.SecretManagerClient
+}
+
+func (sma *SecretManagerAccessorImpl) GetSecret(ctx context.Context, secretId string) (string, error) {
+	req := &secretmanagerpb.AccessSecretVersionRequest{
+		Name: secretId,
+	}
+
+	result, err := sma.Client.AccessSecretVersion(ctx, req)
+	if err != nil {
+		return "", fmt.Errorf("failed to access secret version: %v", err)
+	}
+
+	return string(result.Payload.Data), nil
+}

accessors/secretmanager/secret_manager_accessor_test.go

@@ -0,0 +1,64 @@
+package secretmanageraccessor
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	googleapis "github.com/googleapis/gax-go/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+// MockSecretManagerClient is a mock of SecretManagerClient interface
+type MockSecretManagerClient struct {
+	mock.Mock
+}
+
+func (m *MockSecretManagerClient) AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...googleapis.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error) {
+	args := m.Called(ctx, req, opts)
+	return args.Get(0).(*secretmanagerpb.AccessSecretVersionResponse), args.Error(1)
+}
+
+func (m *MockSecretManagerClient) Close() error {
+	args := m.Called()
+	return args.Error(0)
+}
+
+func TestGetSecret(t *testing.T) {
+	mockClient := new(MockSecretManagerClient)
+	accessor := &SecretManagerAccessorImpl{Client: mockClient}
+	ctx := context.Background()
+	secretId := "projects/my-project/secrets/my-secret/versions/latest"
+	expectedPwd := "my-password"
+
+	mockClient.On("AccessSecretVersion", ctx, mock.MatchedBy(func(req *secretmanagerpb.AccessSecretVersionRequest) bool {
+		return req.Name == secretId
+	}), mock.Anything).Return(&secretmanagerpb.AccessSecretVersionResponse{
+		Payload: &secretmanagerpb.SecretPayload{
+			Data: []byte(expectedPwd),
+		},
+	}, nil)
+
+	pwd, err := accessor.GetSecret(ctx, secretId)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedPwd, pwd)
+	mockClient.AssertExpectations(t)
+}
+
+func TestGetSecret_Error(t *testing.T) {
+	mockClient := new(MockSecretManagerClient)
+	accessor := &SecretManagerAccessorImpl{Client: mockClient}
+	ctx := context.Background()
+	secretId := "projects/my-project/secrets/my-secret/versions/latest"
+
+	mockClient.On("AccessSecretVersion", ctx, mock.MatchedBy(func(req *secretmanagerpb.AccessSecretVersionRequest) bool {
+		return req.Name == secretId
+	}), mock.Anything).Return(&secretmanagerpb.AccessSecretVersionResponse{}, fmt.Errorf("client error"))
+
+	_, err := accessor.GetSecret(ctx, secretId)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "failed to access secret version")
+	mockClient.AssertExpectations(t)
+}

common/utils/secrets.go

@@ -0,0 +1,31 @@
+package utils
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	secretmanagerclient "github.com/GoogleCloudPlatform/spanner-migration-tool/accessors/clients/secretmanager"
+	secretmanageraccessor "github.com/GoogleCloudPlatform/spanner-migration-tool/accessors/secretmanager"
+)
+
+// FetchPasswordFromSecretManager fetches the password from Secret Manager.
+// It returns the resolved secret ID (with version if added), the password, and any error.
+func FetchPasswordFromSecretManager(secretId string) (string, string, error) {
+	secretId = strings.TrimSuffix(secretId, "/")
+	if !strings.Contains(secretId, "/versions/") {
+		secretId += "/versions/latest"
+	}
+	ctx := context.Background()
+	smc, err := secretmanagerclient.NewSecretManagerClient(ctx)
+	if err != nil {
+		return secretId, "", fmt.Errorf("failed to create secret manager client: %v", err)
+	}
+
+	sma := &secretmanageraccessor.SecretManagerAccessorImpl{Client: smc}
+	pwd, err := sma.GetSecret(ctx, secretId)
+	if err != nil {
+		return secretId, "", fmt.Errorf("failed to fetch password from secret manager: %v", err)
+	}
+	return secretId, pwd, nil
+}

common/utils/secrets_test.go

@@ -0,0 +1,113 @@
+package utils
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	secretmanagerclient "github.com/GoogleCloudPlatform/spanner-migration-tool/accessors/clients/secretmanager"
+	googleapis "github.com/googleapis/gax-go/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+type MockSecretManagerClient struct {
+	mock.Mock
+}
+
+func (m *MockSecretManagerClient) AccessSecretVersion(ctx context.Context, req *secretmanagerpb.AccessSecretVersionRequest, opts ...googleapis.CallOption) (*secretmanagerpb.AccessSecretVersionResponse, error) {
+	args := m.Called(ctx, req, opts)
+	return args.Get(0).(*secretmanagerpb.AccessSecretVersionResponse), args.Error(1)
+}
+
+func (m *MockSecretManagerClient) Close() error {
+	args := m.Called()
+	return args.Error(0)
+}
+
+func TestFetchPasswordFromSecretManager(t *testing.T) {
+	mockClient := new(MockSecretManagerClient)
+
+	// Override the client creation function
+	oldNewClient := secretmanagerclient.NewSecretManagerClient
+	secretmanagerclient.NewSecretManagerClient = func(ctx context.Context) (secretmanagerclient.SecretManagerClient, error) {
+		return mockClient, nil
+	}
+	defer func() { secretmanagerclient.NewSecretManagerClient = oldNewClient }()
+
+	testCases := []struct {
+		name           string
+		secretId       string
+		mockResponse   *secretmanagerpb.AccessSecretVersionResponse
+		mockError      error
+		expectedSecret string
+		expectedPwd    string
+		expectError    bool
+	}{
+		{
+			name:     "Success with version",
+			secretId: "projects/my-project/secrets/my-secret/versions/1",
+			mockResponse: &secretmanagerpb.AccessSecretVersionResponse{
+				Payload: &secretmanagerpb.SecretPayload{
+					Data: []byte("password123"),
+				},
+			},
+			expectedSecret: "projects/my-project/secrets/my-secret/versions/1",
+			expectedPwd:    "password123",
+			expectError:    false,
+		},
+		{
+			name:     "Success without version (appends latest)",
+			secretId: "projects/my-project/secrets/my-secret",
+			mockResponse: &secretmanagerpb.AccessSecretVersionResponse{
+				Payload: &secretmanagerpb.SecretPayload{
+					Data: []byte("password456"),
+				},
+			},
+			expectedSecret: "projects/my-project/secrets/my-secret/versions/latest",
+			expectedPwd:    "password456",
+			expectError:    false,
+		},
+		{
+			name:        "Client error",
+			secretId:    "projects/my-project/secrets/my-secret",
+			mockError:   fmt.Errorf("client error"),
+			expectError: true,
+		},
+		{
+			name:     "Success with trailing slash (appends latest)",
+			secretId: "projects/my-project/secrets/my-secret/",
+			mockResponse: &secretmanagerpb.AccessSecretVersionResponse{
+				Payload: &secretmanagerpb.SecretPayload{
+					Data: []byte("password789"),
+				},
+			},
+			expectedSecret: "projects/my-project/secrets/my-secret/versions/latest",
+			expectedPwd:    "password789",
+			expectError:    false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if !tc.expectError {
+				mockClient.On("AccessSecretVersion", mock.Anything, mock.MatchedBy(func(req *secretmanagerpb.AccessSecretVersionRequest) bool {
+					return req.Name == tc.expectedSecret
+				}), mock.Anything).Return(tc.mockResponse, nil).Once()
+			} else if tc.mockError != nil {
+				mockClient.On("AccessSecretVersion", mock.Anything, mock.Anything, mock.Anything).Return(&secretmanagerpb.AccessSecretVersionResponse{}, tc.mockError).Once()
+			}
+
+			secretId, pwd, err := FetchPasswordFromSecretManager(tc.secretId)
+
+			if tc.expectError {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expectedSecret, secretId)
+				assert.Equal(t, tc.expectedPwd, pwd)
+			}
+		})
+	}
+}